ai-research-survey

scan.json (19897B)

---

 {
   "paper": {
     "title": "CoTDeceptor: Adversarial Code Obfuscation Against CoT-Enhanced LLM Code Agents",
     "authors": ["Haoyang Li", "Mingjin Li", "Jinxin Zuo", "Siqi Li", "Xiao Li", "Hao Wu", "Yueming Lu", "Xiaochuan He"],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2512.21250"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "GitHub link provided: https://github.com/hiki9712/CoT-Code-Obfuscation (footnote on page 1)."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The malicious code dataset was 'provided through collaboration with QiAnXin' (Section 5.1) but no public download link or dataset release is mentioned."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or environment setup section is provided. The paper does not specify library versions or dependencies."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README with commands, or scripts to replicate experiments are described in the paper."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Tables 2-4 report only point estimates (pass/fail, scores, F1) with no confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims CoTDeceptor outperforms CodeBreaker and other baselines but provides no statistical significance tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "Results are reported as pass/fail counts and raw F1 scores. No effect sizes (Cohen's d, odds ratios) or baseline-contextualized percentage improvements are provided."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "500 vulnerable samples are used (Section 5.2) and 15 vulnerability categories tested, but no justification for these sizes is given."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance, or spread measures are reported across experimental runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 compares CoTDeceptor against CodeBreaker across the same vulnerability categories and detectors."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include CodeBreaker (USENIX Security 2024), ITGen (ICSE 2025), Flashboom (IEEE S&P 2025), and TrojanPuzzle (IEEE S&P 2024) — all recent."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "No ablation study removing individual components (reflection module, strategy tree, MoE voting) to measure their contribution."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses evasion pass rate, potential scores, average rollout cycles, and precision/recall/F1 for the fine-tuning experiment (Tables 2-4)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation of the obfuscated code quality, readability, or semantic preservation is included. All evaluation is automated."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No explicit separation of dev and test splits is described. The same vulnerability samples appear to be used for both strategy development and evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 provides per-vulnerability-category breakdown across 15 CWE types."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 shows avoid-pickle failed for both CoTDeceptor and CodeBreaker against DeepSeek-R1. Table 3 also shows avoid-pickle as a failure case. Section 5.6 discusses semantic drift and limitations."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The avoid-pickle vulnerability category consistently fails across experiments. Section 5.6 acknowledges computational overhead and occasional semantic drift."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims '14 out of 15 vulnerability categories bypassed' and 'only 2 bypassed by prior methods' are supported by Table 2 results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims about CoTDeceptor's obfuscation causing evasion are justified through controlled experiments comparing before/after obfuscation detection rates. The case study (Section 5.5) demonstrates the causal mechanism."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims applicability to 'CoT-Enhanced LLM Code Agents' generally, but evaluation covers only a few specific models (DeepSeek-R1, GPT-5, Qwen3 variants, Codex). The paper does not bound claims to tested models."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of alternative explanations for evasion success, such as whether the obfuscation simply makes code longer/more complex (confusing any analyzer, not just CoT), or whether the detector failures are due to general model limitations rather than CoT-specific weaknesses."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are named as 'DeepSeek-R1', 'GPT-5', 'GPT-5.1', 'GPT-5.2', 'Gemini-3-Pro', 'Qwen3' without specific version identifiers, snapshot dates, or API versions."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Appendix B provides concrete prompt templates for security analysis, strategy planning, and strategy reflection, with the actual text and placeholder variables clearly shown."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No temperature, top-p, max tokens, or other LLM hyperparameters are reported for any of the models used."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The multi-agent framework is described in detail in Section 4: generator, verifier (three phases), reflection module, and strategy tree exploration with Thompson Sampling."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The malicious code samples are described as 'provided through collaboration with QiAnXin' covering diverse CWE categories (Section 5.1) but no details on how samples were selected, filtered, or preprocessed."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.6 'Discussion and Limitations' discusses computational overhead, semantic drift, and dependence on detector hyperparameters."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The limitations in Section 5.6 are somewhat generic ('computational overhead', 'occasional semantic drift'). No specific threats like dataset representativeness or potential overfitting to particular detector versions are discussed."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show — e.g., no acknowledgment that results may not generalize beyond the tested CWE categories, languages, or specific model versions."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The malicious code dataset from QiAnXin is not publicly released. No raw experimental logs or intermediate results are provided."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "Section 5.1 says 'real-world vulnerable code provided through collaboration with QiAnXin, covering diverse CWE categories' but provides no details on how samples were selected, how many were initially available, or inclusion criteria."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "No documentation of how the 500 vulnerable samples were derived from the QiAnXin collaboration, or how CWE categories were selected."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgments section lists National Natural Science Foundation of China (Grant No. 62402057) and State Key Laboratory of Cyberspace Security Defense (Grant No. 2025-C08)."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed including QiAnXin Technology Group (author Xiaochuan He), which provided the malicious code dataset."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Funders are the National Natural Science Foundation of China and a state key lab — neither has a financial interest in the specific attack framework succeeding."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement is present. One author is from QiAnXin (a security company), which could have commercial interest in the findings, but this is not acknowledged."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests an attack framework's ability to evade detectors, not a model's benchmark performance. Contamination is not relevant to the evasion claims."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Not a benchmark evaluation of model knowledge; this tests adversarial evasion capabilities."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not a benchmark evaluation of model knowledge."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The framework involves multi-round rollouts with multiple LLMs (1-46 cycles per vulnerability) but no API costs, token counts, or wall-clock times are reported."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, GPU hours, or API spend is reported despite the approach requiring extensive multi-round LLM interaction."
       }
     }
   },
   "claims": [
     {
       "claim": "CoTDeceptor bypasses 14 out of 15 vulnerability categories against CoT-enhanced LLM detectors, compared to only 2 by CodeBreaker.",
       "evidence": "Table 2 shows CoTDeceptor passing DeepSeek-R1 for 14/15 categories (all except avoid-pickle) while CodeBreaker passes only 2 (avoid-bind-to-all-interfaces and flask-wtf-csrf-disabled).",
       "supported": "strong"
     },
     {
       "claim": "A weaker strategy model (deepseek-r1-distill-qwen-32b) can successfully evolve obfuscation strategies that mislead a stronger detector (deepseek-r1-distill-llama-70b).",
       "evidence": "Table 3 shows the small model succeeding on 14/15 categories, though with higher average cycle counts in some cases (Section 5.3).",
       "supported": "moderate"
     },
     {
       "claim": "Fine-tuning Qwen3-4B on CoTDeceptor-generated obfuscation data improves detection F1 from 0.5333 to 0.6667.",
       "evidence": "Table 4 shows Qwen3-4B base at 0.5333 F1 vs Qwen3-4B-SFT at 0.6667 F1.",
       "supported": "weak"
     },
     {
       "claim": "CoTDeceptor can bypass real-world code agents (Codex, Qwen Code) in an end-to-end case study.",
       "evidence": "Section 5.5 demonstrates one case study with pyramid-csrf-check-disabled where both Codex and Qwen Code failed to detect the vulnerability after obfuscation (Figure 3).",
       "supported": "weak"
     }
   ],
   "methodology_tags": ["benchmark-eval", "case-study"],
   "key_findings": "CoTDeceptor is a multi-agent reinforcement-learning framework that generates adversarial code obfuscations to evade CoT-enhanced LLM vulnerability detectors. It bypasses 14 of 15 vulnerability categories against DeepSeek-R1 and GPT-5 detectors, compared to 2 for the best prior method (CodeBreaker). A weaker strategy model can evolve obfuscations that fool stronger detectors, demonstrating capability amplification. Fine-tuning small models on CoTDeceptor-generated data improves their detection robustness.",
   "red_flags": [
     {
       "flag": "No ablation study",
       "detail": "The framework has multiple components (reflection module, strategy tree with Thompson Sampling, MoE voting, three-phase verification) but no ablation study isolates which components are responsible for the improvements."
     },
     {
       "flag": "Single case study for real-world agents",
       "detail": "The end-to-end agent evaluation (Section 5.5) uses only one vulnerability (pyramid-csrf-check-disabled) against two agents. This is too narrow to support claims about real-world implications."
     },
     {
       "flag": "No cost reporting despite expensive approach",
       "detail": "CoTDeceptor requires 1-46 multi-round rollouts per vulnerability with multiple LLM calls per round, but no costs or compute budget are reported."
     },
     {
       "flag": "Proprietary dataset",
       "detail": "The malicious code dataset from QiAnXin is not publicly available, making independent verification impossible."
     },
     {
       "flag": "Potential conflict of interest not acknowledged",
       "detail": "One author is from QiAnXin, which provided the dataset and is a security company that could benefit from demonstrating weaknesses in LLM-based detection. This conflict is not acknowledged."
     },
     {
       "flag": "Fine-tuning claim based on very small sample",
       "detail": "Table 4 F1 improvements appear based on a very small evaluation set (9 samples based on recall denominators), making the fine-tuning claim unreliable."
     }
   ],
   "cited_papers": [
     {
       "title": "TrojanPuzzle: Covertly Poisoning Code-Suggestion Models",
       "authors": ["Hojjat Aghakhani", "Wei Dai", "Andre Manoel"],
       "year": 2024,
       "relevance": "Adversarial attack on code completion models via template-based token masking, directly relevant baseline."
     },
     {
       "title": "An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities Against Strong Detection",
       "authors": ["Shenao Yan", "Shen Wang", "Yue Duan"],
       "year": 2024,
       "relevance": "CodeBreaker baseline that uses LLMs for malicious payload transformation against vulnerability detectors."
     },
     {
       "title": "Make a Feint to the East While Attacking in the West: Blinding LLM-based Code Auditors with Flashboom Attacks",
       "authors": ["Xiao Li", "Yue Li", "Hao Wu"],
       "year": 2025,
       "relevance": "Attention manipulation attack against LLM-based code auditors, key baseline in adversarial code security."
     },
     {
       "title": "Iterative Generation of Adversarial Example for Deep Code Models",
       "authors": ["Li Huang", "Weifeng Sun", "Meng Yan"],
       "year": 2025,
       "relevance": "ITGen baseline using iterative feedback-driven identifier replacement for adversarial code generation."
     },
     {
       "title": "Security Weaknesses of Copilot-Generated Code in GitHub Projects: An Empirical Study",
       "authors": ["Yujia Fu", "Peng Liang", "Amjed Tahir"],
       "year": 2023,
       "relevance": "Empirical study of security vulnerabilities in AI-generated code, motivating the supply chain threat model."
     },
     {
       "title": "Vulnerability Detection with Code Language Models: How Far Are We?",
       "authors": ["Yangruibo Ding", "Yanjun Fu", "Omniyyah Ibrahim"],
       "year": 2024,
       "relevance": "PrimeVul dataset challenging LLM effectiveness for vulnerability detection."
     },
     {
       "title": "Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositories",
       "authors": ["Alperen Yildiz", "Sin G Teo", "Yiling Lou"],
       "year": 2025,
       "relevance": "JITVUL benchmark evaluating LLM agents for repository-level vulnerability detection."
     },
     {
       "title": "LLMs Cannot Reliably Identify and Reason About Security Vulnerabilities (Yet?)",
       "authors": ["Saad Ullah", "Mingji Han", "Saurabh Pujar"],
       "year": 2024,
       "relevance": "Comprehensive evaluation of LLM limitations in security vulnerability detection."
     },
     {
       "title": "DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning",
       "authors": ["DeepSeek-AI"],
       "year": 2025,
       "arxiv_id": "2501.12948",
       "relevance": "Primary strategy generator model used in CoTDeceptor experiments."
     },
     {
       "title": "ReAct: Synergizing Reasoning and Acting in Language Models",
       "authors": ["Shunyu Yao", "Jeffrey Zhao", "Dian Yu"],
       "year": 2023,
       "relevance": "Foundational reasoning+acting framework that CoTDeceptor's iterative approach builds upon."
     }
   ]
 }